Symantec Security Expressions Server manual Other Options Settings, Credentials Settings

Page 78

SecurityExpressions Server User Guide

restart would take.

B. If you want to set a time limit on how long the task can attempt reaudits, type the number of hours you want to allot for reaudits in the Attempt re-audit for this many hours after initial audit box.

A reaudit cycle could go on indefinitely if a system is off or never connects. Setting a time limit keeps the reaudit cycle from continuing indefinitely.

C. If you want to limit the amount of times the task can attempt to reaudit, type the number of reaudit attempts you'll allow in the Maximum number of attempts to re-audit box.

A reaudit cycle could go on indefinitely if a system is off or never connects. Limiting the number of times the task can attempt to reaudit systems keeps the reaudit cycle from continuing indefinitely.

Both steps B and C provide end points to the reaudit cycle. You may use one method or the other, or both. If you use both methods together, whichever limit is reached first ends the audit cycle.

Tip: Steps 11 and 12 each provide a way for audits to occur on systems that were not available when the task was scheduled to audit them. You may use these features together or separately. If you use them together, Audit-on-Connect is active both during and after the reaudit cycle.

If a system was contacted but the login credentials were incorrect, the task does not attempt to reaudit the system.

Other Options Settings

13.If you want to limit the length of time this task takes to complete from the time it actually begins auditing, regardless of the reason, click the Limit to Hours radio button in the Maximum amount of time an audit may run section. Then type the number of hours to which you want to limit the task.

After this number of hours, the task finishes auditing the system it was working on and then terminates. If reauditing or Audit-on-Connect on Fail is part of the task, they are included as part of the overall time it takes to run the entire task.

14.If you want to keep track of which target systems the task could not audit, check Enable in the Save target names that could not be contacted to the following machine list section. Then type a name for the machine list, using variables in the name if you want.

The machine list you enter saves the names of all systems that did not get audited as a result of the termination. Auditing this machine list later enables you to finish auditing the

remaining systems.

If you type the name of an existing machine list, any systems already listed in it will be removed. Unless you want the machine list altered in the case of an incomplete audit,

we recommend creating a database machine list expressly for this purpose.

Credentials Settings

70

Image 78
Contents SecurityExpressions Server User Guide Page Table Of Contents Page Table Of Contents Page Vii Page Contacting Us Page Technical Support Contacting Technical SupportPage Other Products SecurityExpressions ConsolePage Overview About SecurityExpressions Audit & Compliance ServerPage Self-Service Audit Agreement Self-Service AuditWhat is Self-Service Auditing? How to Audit your Local ComputerDisplays on the page. No detailed audit results appear Local Server Settings Configure ServersAbout Server Configuration Pages with Role SettingsSetup Viewing Audit ResultsDatabase Connection Secure Connection Windows 2000 ServersClick OK on the Default Web Site Properties window Credential Store UserCreating Credential Stores Software Registration Enable Web ServicesSecurityExpressions Console Credential Stores Site PreferencesAccess Global Machine List Access User Roles Item RightsPolicy File Library Library SynchronizationCheck the Synchronize with a policy file library box About Policy Files How System Scores are CalculatedAgent & Service Configuration Default method for remote execution on WindowsTarget Options SSH Agent Authentication Database Cleanup Policies Update TaskCancel Add TaskAgent Downloads Site PreferencesClick Use the Following Agreement Allow Remediation Page Policies What is Audit-on-Connect?Audit-On-Connect Policies TablePage Adding Policies Editing Policies Configuring with Run-Time Policy Variables Deleting PoliciesPage Scopes ScopesAdd a New Scope Page Edit a Scope Scopes Table Expression Scopes Deleting ScopesDNS Domain Name Scopes Supported OperatorsSupported Functions Org Unit ScopesDetection Method Scopes Notifications Click Add New Creating New Command NotificationsCreating New Email Notifications Editing NotificationsClick Add New Creating New Command Notifications Deleting Notifications Notification VariablesExceptions Table Column Description ExceptionsExceptions Adding ExceptionsDeleting Exceptions Specify Password and Encrypted PasswordConnection Monitors Connection MonitorsConfiguring Connection Monitors RemoveEnabling Connection Monitors Connection Monitor Configuration File IP Range SectionDefault OptionsProcessing the Configuration File Configuration File SyntaxActive Directory Active Directory Connection Monitor only Network Slow LinksUnmanaged Systems Trace Route InformationNetwork Admissions Control Initial TokenReaudit if quarantined HealthyQuarantined/Unknown Redirection WebAudit on Connect Tracing Redirection Web Page BehaviorAudit on Connect Tracing Page Page What is Audit-on-Schedule? Audit-On-SchedulePage Adding Policies Editing Policies Deleting Policies Page Notifications Click Add New Click Add New Deleting Notifications My Machine Lists My Machine ListsAdding Machine Lists Editing Machine ListsEditing Global Machine Lists Scheduled TasksDeleting Machine Lists Scheduled TasksBasic Settings Adding Scheduled TasksSchedule Settings Hosts Not Connected Settings Other Options Settings Credentials SettingsWindows Group Access Editing Scheduled TasksSchedule Settings Notifications Other Options Settings Deleting Scheduled Tasks Page Audit-On-Connect Activity Table Column Description View Audit-On-Connect ActivityBrowse Audit-On-Connect Activity Adding a New Audit-On-Connect Report ProfileEditing Report Profiles Deleting Report ProfilesAudit-On-Connect Error Log Report Audit-On-Connect Exceptions ReportPage View Audit Results Browse Audit ResultsAdding a New Audit Results Report Profile Page Editing Audit Report Results Profiles Scheduled Audits Log ReportAdding Custom Reports to the Server Application Deleting Audit Report Results ProfilesPage Glossary Page Configure IndexIP address 33, 44, 45 Rule weights